CVE-2025-52616

HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities in the application...

CVE-2025-11371 Gladinet CentreStack and TrioFox Local File Inclusion Flaw

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and...

CVE-2025-60967

Cross Site Scripting XSS vulnerability in EndRun Technologies Sonoma D12 Network Time Server GPS F/W 6010-0076-000 Ver 4.00 allows attackers to gain sensitive information...

CVE-2025-61685

The CVE concerns Mastra (Typescript framework) with vulnerable versions 0.13.8–0.13.20-alpha.0, where a Directory Traversal flaw affects the MCP server package @mastra/mcp-docs-server. The issue stems from bypassable path-traversal checks in readMdxContent combined with a flawed execute path that...

EUVD-2025-24859

Malicious code in bioql PyPI...

EUVD-2025-27769

Malicious code in bioql PyPI...

GE UR family Exposure of Sensitive Information to an Unauthorized Actor (CVE-2021-27424)

GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a Last-key pressed MODBUS register can be used to gain unauthorized information. This plugin only works with Tenable.ot. Please visit...

Cloudflare Workers SDK 信息泄露漏洞

Cloudflare Workers SDK is an open source developer toolkit for Cloudflare. An information disclosure vulnerability exists in Cloudflare Workers SDK versions prior to 1.6.0, which stems from a default configuration where the local development server exposes all files, potentially leading to the...

CVE-2025-59691

CVE-2025-59691 affects PureVPN Linux clients (CLI 2.0.1 and GUI 2.10.0). The vulnerability allows IPv6 traffic to leak outside the VPN tunnel during events like Wi‑Fi reconnects or system resume, with the CLI auto-reconnect showing as connected while IPv6 isn’t routed or blocked, and the GUI leav...

PT-2025-37277

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.124 Liferay DXP versions 2024.Q1.1 through 2024.Q1.12 Liferay DXP versions 7.4 update 81 through update 85 Description: The organization selector does not verify user permissions, potentially allowi...

CVE-2025-40803

A vulnerability has been identified in RUGGEDCOM RST2428P 6GK6242-6PA00 All versions. The affected device exposes certain non-critical information from the device. This could allow an unauthenticated attacker to access sensitive data, potentially leading to a breach of confidentiality...

Linux Distros Unpatched Vulnerability : CVE-2018-17175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema only option treats an empty list as implying no only option, which allows...

Cleartext Transmission Of Sensitive Information

github.com/go-acme/lego is vulnerable to Cleartext Transmission of Sensitive Information. The vulnerability is due to the library not enforcing HTTPS when communicating with Certificate Authorities CAs, which allows attackers to intercept ACME protocol operations and access sensitive details like...

CVE-2025-50971

Directory traversal vulnerability in AbanteCart version 1.4.2 allows unauthenticated attackers to gain access to sensitive system files via the template parameter to index.php...

PT-2025-34657 · Dasan · Dasan Gpon Onu H660Wm +1

Name of the Vulnerable Software and Affected Versions: DASAN GPON ONU H660WM H660WMR210825 Description: An incorrect access control issue exists in the /cgi-bin/system diagnostic main.asp component, potentially allowing attackers to access sensitive information. Recommendations: At the moment,...

CVE-2024-53496

Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication...

PT-2025-33390 · Nordicmade · Savoy

Name of the Vulnerable Software and Affected Versions: NordicMade Savoy versions through 3.0.8 Description: An issue exists in NordicMade Savoy that allows the retrieval of embedded sensitive data due to exposure of sensitive system information to an unauthorized control sphere. Recommendations: ...

CVE-2025-27707

Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software before version 24.11.1 for IntelR TiberTM Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access...

CVE-2025-53728

CVE-2025-53728 affects Microsoft Dynamics 365 (on-premises) (version 9.1) with an information disclosure vulnerability that allows an unauthenticated network attacker to obtain sensitive data. The root cause is exposure of information to an unauthorized actor over a network. Microsoft has release...

CVE-2024-41984

A vulnerability has been identified in SmartClient modules Opcenter QL Home SC All versions = V13.2 = V13.2 = V13.2 V2506. The affected application improperly handles error while accessing an inaccessible resource leading to exposing the system applications...